network July 2017

network@lists.ipfire.org

2 participants
36 discussions

[PATCH v2 1/2] ipsec: add new functions
by Jonatan Schlag 29 Jul '17

29 Jul '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- Makefile.am | 1 + src/functions/functions.ipsec | 579 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 580 insertions(+) create mode 100644 src/functions/functions.ipsec diff --git a/Makefile.am b/Makefile.am index 761e849..2ce7a34 100644 --- a/Makefile.am +++ b/Makefile.am @@ -160,6 +160,7 @@ dist_network_SCRIPTS = \ src/functions/functions.usb \ src/functions/functions.util \ src/functions/functions.vlan \ + src/functions/functions.ipsec \ src/functions/functions.vpn-security-policies \ src/functions/functions.wireless \ src/functions/functions.wpa_supplicant \ diff --git a/src/functions/functions.ipsec b/src/functions/functions.ipsec new file mode 100644 index 0000000..5e9327b --- /dev/null +++ b/src/functions/functions.ipsec @@ -0,0 +1,579 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2017 IPFire Network Development Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE INACTIVITY_TIMEOUT LOCAL_ID LOCAL_PREFIX" +IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} MODE PEER PSK" +IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} REMOTE_ID REMOTE_PREFIX" +IPSEC_CONNECTION_CONFIG_SETTINGS="${IPSEC_CONNECTION_CONFIG_SETTINGS} SECURITY_POLICY" + +# Default values +IPSEC_DEFAULT_MODE="tunnel" +IPSEC_DEFAULT_AUTH_MODE="psk" +IPSEC_DEFAULT_INACTIVITY_TIMEOUT="0" +IPSEC_DEFAULT_SECURITY_POLICY="system" + +IPSEC_VALID_MODES="gre-transport tunnel vti" +IPSEC_VALID_AUTH_MODES="PSK psk" + +# This function writes all values to a via ${connection} specificated VPN IPsec configuration file +ipsec_connection_write_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + + if ! ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + local path="$(ipsec_connection_path "${connection}")/settings" + + if ! settings_write "${path}" ${IPSEC_CONNECTION_CONFIG_SETTINGS}; then + log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi + + ipsec_reload ${connection} +} + +# This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file +ipsec_connection_write_config_key() { + assert [ $# -ge 3 ] + + local connection=${1} + local key=${2} + shift 2 + + local value="$@" + + if ! ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN ipsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'" + + local ${IPSEC_CONNECTION_CONFIG_SETTINGS} + + # Read the config settings + if ! ipsec_connection_read_config "${connection}"; then + return ${EXIT_ERROR} + fi + + # Set the key to a new value + assign "${key}" "${value}" + + if ! ipsec_connection_write_config "${connection}"; then + return ${EXIT_ERROR} + fi + + return ${EXIT_TRUE} +} + +# Reads one or more keys out of a settings file or all if no key is provided. +ipsec_connection_read_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + shift 1 + + if ! ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection : ${connection}" + return ${EXIT_ERROR} + fi + + + local args + if [ $# -eq 0 ] && [ -n "${IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then + list_append args ${IPSEC_CONNECTION_CONFIG_SETTINGS} + else + list_append args $@ + fi + + local path="$(ipsec_connection_path "${connection}")/settings" + + if ! settings_read "${path}" ${args}; then + log ERROR "Could not read settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi +} + +# Returns the path to a the directory for given connection +ipsec_connection_path() { + assert [ $# -eq 1 ] + + local connection=${1} + + echo "${NETWORK_CONFIG_DIR}/vpn/ipsec/connection/${connection}" +} + +# This function checks if a vpn ipsec connection exists +# Returns True when yes and false when not +ipsec_connection_exists() { + assert [ $# -eq 1 ] + + local connection=${1} + + local path=$(ipsec_connection_path "${connection}") + + [ -d "${path}" ] && return ${EXIT_TRUE} || return ${EXIT_FALSE} +} + +# Reloads the connection after config changes +ipsec_reload() { + return ${EXIT_TRUE} +} + +# Handle the cli after authentification +ipsec_connection_authentication() { + if [ ! $# -gt 1 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + mode) + ipsec_connection_authentication_mode "${connection}" $@ + ;; + pre-shared-key) + ipsec_connection_authentication_psk "${connection}" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac +} + +# Set the authentification mode +ipsec_connection_authentication_mode() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode ${IPSEC_VALID_AUTH_MODES}; then + log ERROR "Auth mode '${mode}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "AUTH_MODE" ${mode,,}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Set the psk +ipsec_connection_authentication_psk() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local psk=${2} + + # TODO Check if psk is valid + + if ! ipsec_connection_write_config_key "${connection}" "PSK" ${psk}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Handle the cli after local +ipsec_connection_local() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + id) + ipsec_connection_id "${connection}" "LOCAL" $@ + ;; + prefix) + ipsec_connection_prefix "${connection}" "LOCAL" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} +} + +# Set the connection mode +ipsec_connection_mode() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode ${IPSEC_VALID_MODES}; then + log ERROR "Mode '${mode}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "MODE" ${mode}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Set the peer to connect to +ipsec_connection_peer() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local peer=${2} + + if ! ipsec_connection_check_peer ${peer}; then + log ERROR "Peer '${peer}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "PEER" ${peer}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +#Set the local or remote id +ipsec_connection_id() { + if [ ! $# -eq 3 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + local id=${3} + + if ! ipsec_connection_check_id ${id}; then + log ERROR "Id '${id}' is invalid" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "${type}_ID" ${id}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Set the local or remote prefix +ipsec_connection_prefix() { + if [ ! $# -ge 3 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + shift 2 + + local _prefix="${type}_PREFIX" + local "${_prefix}" + if ! ipsec_connection_read_config "${connection}" "${_prefix}"; then + return ${EXIT_ERROR} + fi + + # Remove duplicated entries to proceed the list safely + assign "${_prefix}" "$(list_unique ${!_prefix} )" + + local prefixes_added + local prefixes_removed + local prefixes_set + + while [ $# -gt 0 ]; do + local arg="${1}" + + case "${arg}" in + +*) + list_append prefixes_added "${arg:1}" + ;; + -*) + list_append prefixes_removed "${arg:1}" + ;; + [A-Fa-f0-9]*) + list_append prefixes_set "${arg}" + ;; + *) + error "Invalid argument: ${arg}" + return ${EXIT_ERROR} + ;; + esac + shift + done + + # Check if the user is trying a mixed operation + if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then + error "You cannot reset the prefix list and add or remove prefixes at the same time" + return ${EXIT_ERROR} + fi + + # Set new prefix list + if ! list_is_empty prefixes_set; then + # Check if all prefixes are valid + local prefix + for prefix in ${prefixes_set}; do + if ! ip_net_is_valid ${prefix}; then + error "Unsupported prefix: ${prefix}" + return ${EXIT_ERROR} + fi + done + + assign "${_prefix}" "${prefixes_set}" + + # Perform incremental updates + else + local prefix + + # Perform all removals + for prefix in ${prefixes_removed}; do + if ! list_remove "${_prefix}" ${prefix}; then + warning "${prefix} was not on the list and could not be removed" + fi + done + + + for prefix in ${prefixes_added}; do + if ip_net_is_valid ${prefix}; then + if ! list_append_unique "${_prefix}" ${prefix}; then + warning "${prefix} is already on the prefix list" + fi + else + warning "${prefix} is not a valiv IP net and could not be added" + fi + done + fi + + # Check if the list contain at least one valid prefix + if list_is_empty ${_prefix}; then + error "Cannot save an empty prefix list" + return ${EXIT_ERROR} + fi + + # Save everything + if ! ipsec_connection_write_config_key "${connection}" "${_prefix}" ${!_prefix}; then + log ERROR "Could not write configuration settings" + fi + + return ${EXIT_OK} +} + +# Handle the cli after remote +ipsec_connection_remote() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + id) + ipsec_connection_id "${connection}" "REMOTE" $@ + ;; + + prefix) + ipsec_connection_prefix "${connection}" "REMOTE" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} +} + +# Set the inactivity timeout +ipsec_connection_inactivity_timeout() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + shift 1 + local value=$@ + + if ! isinteger value; then + value=$(parse_time $@) + if [ ! $? -eq 0 ]; then + log ERROR "Parsing the passed time was not sucessful please check the passed values." + return ${EXIT_ERROR} + fi + fi + + if [ ${value} -le 0 ]; then + log ERROR "The passed time value must be in the sum greater zero seconds." + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "INACTIVITY_TIMEOUT" ${value}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + + +# Set the security policy to use +ipsec_connection_security_policy() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local security_policy=${2} + + if ! vpn_security_policy_exists ${security_policy}; then + log ERROR "No such vpn security policy '${security_policy}'" + return ${EXIT_ERROR} + fi + + if ! ipsec_connection_write_config_key "${connection}" "SECURITY_POLICY" ${security_policy}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Check if a id is valid +ipsec_connection_check_id() { + assert [ $# -eq 1 ] + local id=${1} + + if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# Checks if a peer is valid +ipsec_connection_check_peer() { + assert [ $# -eq 1 ] + local peer=${1} + + # TODO Accept also FQDNs + if ip_is_valid ${peer}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# This function checks if a VPN IPsec connection name is valid +# Allowed are only A-Za-z0-9 +ipsec_connection_check_name() { + assert [ $# -eq 1 ] + + local connection=${1} + + [[ "${connection}" =~ [^[:alnum:]$] ]] +} + +# Function that creates one VPN IPsec connection +ipsec_connection_new() { + if [ $# -gt 1 ]; then + error "Too many arguments" + return ${EXIT_ERROR} + fi + + local connection="${1}" + if ! isset connection; then + error "Please provide a connection name" + return ${EXIT_ERROR} + fi + + # Check for duplicates + if ipsec_connection_exists "${connection}"; then + error "The VPN IPsec connection ${connection} already exists" + return ${EXIT_ERROR} + fi + + # Check if the name of the connection is valid + if ipsec_connection_check_name "${connection}"; then + error "'${connection}' contains illegal characters" + return ${EXIT_ERROR} + fi + + log DEBUG "Creating VPN IPsec connection ${connection}" + + if ! mkdir -p $(ipsec_connection_path "${connection}"); then + log ERROR "Could not create config directory for ${connection}" + return ${EXIT_ERROR} + fi + + local ${IPSEC_CONNECTION_CONFIG_SETTINGS} + + MODE=${IPSEC_DEFAULT_MODE} + AUTH_MODE=${IPSEC_DEFAULT_AUTH_MODE} + INACTIVITY_TIMEOUT=${IPSEC_DEFAULT_INACTIVITY_TIMEOUT} + SECURITY_POLICY=${IPSEC_DEFAULT_SECURITY_POLICY} + + if ! ipsec_connection_write_config "${connection}"; then + log ERROR "Could not write new config file" + return ${EXIT_ERROR} + fi +} + +# Function that deletes based on the passed parameters one ore more vpn security policies +ipsec_connection_destroy() { + local connection + for connection in $@; do + if ! ipsec_connection_exists "${connection}"; then + log ERROR "The VPN IPsec connection ${connection} does not exist." + continue + fi + + log DEBUG "Deleting VPN IPsec connection ${connection}" + if ! rm -rf $(ipsec_connection_path "${connection}"); then + log ERROR "Deleting the VPN IPsec connection ${connection} was not sucessful" + return ${EXIT_ERROR} + fi + done +} -- 2.6.3

1 1

[RFC PATCH 1/2] Add vpn-ipsec functions
by Jonatan Schlag 28 Jul '17

28 Jul '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- Makefile.am | 1 + src/functions/functions.vpn-ipsec | 550 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 551 insertions(+) create mode 100644 src/functions/functions.vpn-ipsec diff --git a/Makefile.am b/Makefile.am index 761e849..c14bb17 100644 --- a/Makefile.am +++ b/Makefile.am @@ -160,6 +160,7 @@ dist_network_SCRIPTS = \ src/functions/functions.usb \ src/functions/functions.util \ src/functions/functions.vlan \ + src/functions/functions.vpn-ipsec \ src/functions/functions.vpn-security-policies \ src/functions/functions.wireless \ src/functions/functions.wpa_supplicant \ diff --git a/src/functions/functions.vpn-ipsec b/src/functions/functions.vpn-ipsec new file mode 100644 index 0000000..2bfa3a2 --- /dev/null +++ b/src/functions/functions.vpn-ipsec @@ -0,0 +1,550 @@ +#!/bin/bash +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2017 IPFire Network Development Team # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="AUTH_MODE INACTIVITY_TIMEOUT LOCAL_ID LOCAL_PREFIX" +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} MODE PEER PSK" +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} REMOTE_ID REMOTE_PREFIX" +VPN_IPSEC_CONNECTION_CONFIG_SETTINGS="${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} SECURITY_POLICY" + +# Default values +MODE="tunnel" +AUTH_MODE="psk" +INACTIVITY_TIMEOUT="0" +SECURITY_POLICY="system" + +# This function writes all values to a via ${connection} specificated VPN IPsec configuration file +vpn_ipsec_connection_write_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + + if ! vpn_ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + local path="$(vpn_ipsec_connection_path "${connection}")" + if [ ! -w ${path} ]; then + log ERROR "${path} is not writeable" + return ${EXIT_ERROR} + fi + + if ! settings_write "${path}" ${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS}; then + log ERROR "Could not write configuration settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi + + # TODO everytime we successfully write a config we should call some trigger to take the changes into effect +} + +# This funtion writes the value for one key to a via ${connection} specificated VPN IPsec connection configuration file +vpn_ipsec_connection_write_config_key() { + assert [ $# -ge 3 ] + + local connection=${1} + local key=${2} + shift 2 + + local value="$@" + + if ! vpn_ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN ipsec connection: ${connection}" + return ${EXIT_ERROR} + fi + + log DEBUG "Set '${key}' to new value '${value}' in VPN ipsec connection '${connection}'" + + local ${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} + + # Read the config settings + if ! vpn_ipsec_connection_read_config "${connection}"; then + return ${EXIT_ERROR} + fi + + # Set the key to a new value + assign "${key}" "${value}" + + if ! vpn_ipsec_connection_write_config "${connection}"; then + return ${EXIT_ERROR} + fi + + return ${EXIT_TRUE} +} + +# Reads one or more keys out of a settings file or all if no key is provided. +vpn_ipsec_connection_read_config() { + assert [ $# -ge 1 ] + + local connection="${1}" + shift 1 + + if ! vpn_ipsec_connection_exists "${connection}"; then + log ERROR "No such VPN IPsec connection : ${connection}" + return ${EXIT_ERROR} + fi + + + local args + if [ $# -eq 0 ] && [ -n "${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS}" ]; then + list_append args ${VPN_IPSEC_CONNECTION_CONFIG_SETTINGS} + else + list_append args $@ + fi + + local path="$(vpn_ipsec_connection_path ${connection})" + + if ! settings_read "${path}" ${args}; then + log ERROR "Could not read settings for VPN IPsec connection ${connection}" + return ${EXIT_ERROR} + fi +} + +# Returns the path to a the configuration for given connection +vpn_ipsec_connection_path() { + assert [ $# -eq 1 ] + + local connection=${1} + + echo "${NETWORK_CONFIG_DIR}/vpn/ipsec/connection/${connection}" +} + +# This function checks if a vpn ipsec connection exists +# Returns True when yes and false when not +vpn_ipsec_connection_exists() { + assert [ $# -eq 1 ] + + local connection=${1} + + local path=$(vpn_ipsec_connection_path "${connection}") + + [ -f ${path} ] && return ${EXIT_TRUE} || return ${EXIT_FALSE} +} + +# Handle the cli after authentification +vpn_ipsec_connection_authentication() { + if [ ! $# -gt 1 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + mode) + vpn_ipsec_connection_authentication_mode ${connection} $@ + ;; + pre-shared-key) + vpn_ipsec_connection_authentication_psk ${connection} $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac +} + +# Set the authentification mode +vpn_ipsec_connection_authentication_mode() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode "psk" "PSK"; then + log ERROR "Auth mode '${mode}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "AUTH_MODE" ${mode,,}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Set the psk +vpn_ipsec_connection_authentication_psk() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local psk=${2} + + # TODO Check if psk is valid + + if ! vpn_ipsec_connection_write_config_key ${connection} "PSK" ${psk}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + +} + +# Handle the cli after local +vpn_ipsec_connection_local() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + prefix) + vpn_ipsec_connection_prefix ${connection} "LOCAL" $@ + ;; + id) + vpn_ipsec_connection_id ${connection} "LOCAL" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} + +} + +# Set the connection mode +vpn_ipsec_connection_mode() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local mode=${2} + + if ! isoneof mode "tunnel" "vti" "gre-transport"; then + log ERROR "Mode '${mode}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "MODE" ${mode}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + +} + +# Set the peer to connect to +vpn_ipsec_connection_peer() { + if [ ! $# -eq 2]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local peer=${2} + + if ! vpn_ipsec_connection_check_peer ${peer}; then + log ERROR "Peer '${peer}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "PEER" ${peer}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +#Set the local or remote id +vpn_ipsec_connection_id() { + if [ ! $# -eq 3]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + local id=${3} + + if ! vpn_ipsec_connection_check_id ${id}; then + log ERROR "Id '${id}' is not valid" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "${type}_ID" ${id}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + + return ${EXIT_OK} +} + +# Set the local or remote prefix +vpn_ipsec_connection_prefix() { + if [ ! $# -ge 3 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local type=${2} + shift 2 + + local _prefix="${type}_PREFIX" + local "${_prefix}" + if ! vpn_ipsec_connection_read_config ${connection} "${_prefix}"; then + return ${EXIT_ERROR} + fi + + # Remove duplicated entries to proceed the list safely + assign "${_prefix}" "$(list_unique ${!_prefix} )" + + local prefixes_added + local prefixes_removed + local prefixes_set + + while [ $# -gt 0 ]; do + local arg="${1}" + + case "${arg}" in + +*) + list_append prefixes_added "${arg:1}" + ;; + -*) + list_append prefixes_removed "${arg:1}" + ;; + [A-Z0-9]*) + list_append prefixes_set "${arg}" + ;; + *) + error "Invalid argument: ${arg}" + return ${EXIT_ERROR} + ;; + esac + shift + done + + # Check if the user is trying a mixed operation + if ! list_is_empty prefixes_set && (! list_is_empty prefixes_added || ! list_is_empty prefixes_removed); then + error "You cannot reset the prefix list and add or remove prefixes at the same time" + return ${EXIT_ERROR} + fi + + # Set new prefixe list + if ! list_is_empty prefixes_set; then + # Check if all prefixes are valid + local prefix + for prefix in ${prefixes_set}; do + if ! ip_net_is_valid ${prefix}; then + error "Unsupported prefix: ${prefix}" + return ${EXIT_ERROR} + fi + done + + assign "${_prefix}" "${prefixes_set}" + + # Perform incremental updates + else + local prefix + + # Perform all removals + for prefix in ${prefixes_removed}; do + if ! list_remove "${_prefix}" ${prefix}; then + warning "${prefix} was not on the list and could not be removed" + fi + done + + for prefix in ${prefixes_added}; do + if ip_net_is_valid ${prefix}; then + if ! list_append_unique "${_prefix}" ${prefix}; then + warning "${prefix} is already on the prefix list" + fi + else + warning "${prefix} is not a valiv IP net and could not be added" + fi + done + fi + + # Check if the list contain at least one valid prefixe + if list_is_empty ${_prefix}; then + error "Cannot save an empty prefix list" + return ${EXIT_ERROR} + fi + + # Save everything + if ! vpn_ipsec_connection_write_config_key ${connection} "${_prefix}" ${!_prefix}; then + log ERROR "Could not write configuration settings" + fi +} + +# Handle the cli after remote +vpn_ipsec_connection_remote() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + local cmd=${2} + shift 2 + + case ${cmd} in + prefix) + vpn_ipsec_connection_prefix ${connection} "REMOTE" $@ + ;; + id) + vpn_ipsec_connection_id ${connection} "REMOTE" $@ + ;; + *) + log ERROR "Unrecognized argument: ${cmd}" + return ${EXIT_ERROR} + ;; + esac + + return ${EXIT_OK} +} + +# Set the inactivity timeout +vpn_ipsec_connection_inactivity_timeout() { + if [ ! $# -ge 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + + local connection=${1} + shift 1 + local value=$@ + + if ! isinteger value; then + value=$(parse_time $@) + if [ ! $? -eq 0 ]; then + log ERROR "Parsing the passed time was not sucessful please check the passed values." + return ${EXIT_ERROR} + fi + fi + + if [ ${value} -le 0 ]; then + log ERROR "The passed time value must be in the sum greater zero seconds." + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "INACTIVITY_TIMEOUT" ${value}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi + +} + +# Set the security policy to use +vpn_ipsec_connection_security_policy() { + if [ ! $# -eq 2 ]; then + log ERROR "Not enough arguments" + return ${EXIT_ERROR} + fi + local connection=${1} + local security_policy=${2} + + if ! vpn_security_policy_exists ${security_policy}; then + log ERROR "No such vpn security policy '${security_policy}'" + return ${EXIT_ERROR} + fi + + if ! vpn_ipsec_connection_write_config_key ${connection} "SECURITY_POLICY" ${security_policy}; then + log ERROR "Could not write configuration settings" + return ${EXIT_ERROR} + fi +} + +# Check if a id is valid +vpn_ipsec_connection_check_id() { + assert [ $# -eq 1 ] + local id=${1} + + if [[ ${id} =~ ^@[[:alnum:]]+$ ]] || ip_is_valid ${id}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# Checks if a peer is valid +vpn_ipsec_connection_check_peer() { + assert [ $# -eq 1 ] + local peer=${1} + + # TODO Accept also FQDNs + if ip_is_valid ${peer}; then + return ${EXIT_TRUE} + else + return ${EXIT_FALSE} + fi +} + +# This function checks if a VPN IPsec connection name is valid +# Allowed are only A-Za-z0-9 +vpn_ipsec_connection_check_name() { + assert [ $# -eq 1 ] + + local connection=${1} + + [[ ${connection} =~ [^[:alnum:]$] ]] +} + +# Function that creates one VPN IPsec connection +vpn_ipsec_connection_new() { + if [ $# -gt 1 ]; then + error "Too many arguments" + return ${EXIT_ERROR} + fi + + local connection="${1}" + if ! isset connection; then + error "Please provide a connection name" + return ${EXIT_ERROR} + fi + + # Check for duplicates + if vpn_ipsec_connection_exists "${connection}"; then + error "The VPN IPsec connection ${connection} already exists" + return ${EXIT_ERROR} + fi + + # Check if the name of the connection is valid + if vpn_ipsec_connection_check_name "${connection}"; then + error "'${connection}' contains illegal characters" + return ${EXIT_ERROR} + fi + + log DEBUG "Creating VPN IPsec connection ${connection}" + + touch $(vpn_ipsec_connection_path ${connection}) + vpn_ipsec_connection_write_config "${connection}" +} + +# Function that deletes based on the passed parameters one ore more vpn security policies +vpn_ipsec_connection_destroy() { + local connection + for connection in $@; do + if ! vpn_ipsec_connection_exists ${connection}; then + log ERROR "The VPN IPsec connection ${connection} does not exist." + continue + fi + + log DEBUG "Deleting VPN IPsec connection ${connection}" + settings_remove $(vpn_ipsec_connection_path ${connection}) + done +} -- 2.6.3

2 4

[PATCH v2] config hook: prevent two hooks with the same settings
by Jonatan Schlag 27 Jul '17

27 Jul '17

A ipv4-static config with the same IPv4 address twice is senseless. A new function zone_config_check_same_setting is introduced. The function provides an easy way to check if a config of the given hook has the same value for a given key. We can now check inside hook_new if an ipv4-static or ipv6-static config with the same value exist and break with an error. Fixes: #11418 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 33 +++++++++++++++++++++++++++++++++ src/hooks/configs/ipv4-static | 5 +++++ src/hooks/configs/ipv6-static | 5 +++++ 3 files changed, 43 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index a3ca029..1eb492f 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -1150,6 +1150,39 @@ zone_config_get_new_id() { done } +zone_config_check_same_setting() { + # This functions checks if a config hook + # with the same setting is already configured for this zone. + # Returns True when yes and False when no. + + assert [ $# -eq 4 ] + + local zone=${1} + local hook=${2} + local key=${3} + local value=${4} + + # The key should be local for this function + local ${key} + local config + + for config in $(zone_configs_list ${zone}); do + # Check if the config is from the given hook, when not continue + if [[ $(zone_config_get_hook "${zone}" "${config}") != ${hook} ]]; then + continue + fi + # Get the value of the key for a given function + zone_config_settings_read "${zone}" "${config}" \ + --ignore-superfluous-settings "${key}" + # Check if the value of the config and the passed value are eqal + if [[ "${value}" == "${!key}" ]]; then + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + zone_config_get_hook() { assert [ $# -eq 2 ] diff --git a/src/hooks/configs/ipv4-static b/src/hooks/configs/ipv4-static index 36629e0..ef74991 100644 --- a/src/hooks/configs/ipv4-static +++ b/src/hooks/configs/ipv4-static @@ -99,6 +99,11 @@ hook_parse_cmdline() { exit ${EXIT_CONF_ERROR} fi + if zone_config_check_same_setting "${zone}" "ipv4-static" "ADDRESS" "${ADDRESS}"; then + error "An ipv4-static config with the same IPv4 address is already configured" + exit ${EXIT_CONF_ERROR} + fi + if ! isset GATEWAY && zone_is_nonlocal "${zone}"; then warning "You did not configure a gateway for a non-local zone" fi diff --git a/src/hooks/configs/ipv6-static b/src/hooks/configs/ipv6-static index 4c1d7df..c41401c 100644 --- a/src/hooks/configs/ipv6-static +++ b/src/hooks/configs/ipv6-static @@ -49,6 +49,11 @@ hook_parse_cmdline() { shift done + if zone_config_check_same_setting "${zone}" "ipv6-static" "ADDRESS" "${ADDRESS}"; then + error "An ipv6-static config with the same IPv6 address is already configured" + exit ${EXIT_CONF_ERROR} + fi + # Store IPv6 address in small format. ADDRESS=$(ipv6_format "${ADDRESS}") -- 2.6.3

1 0

[PATCH v2 1/8] zone: add config hid functions
by Jonatan Schlag 26 Jul '17

26 Jul '17

These are the basic functions to work with hids. Fixes: #11406 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 80 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index bba1705..0696750 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -656,6 +656,69 @@ zone_config_list_ids() { echo ${ids} } +# List all hids of a zone +zone_config_list_hids() { + assert [ $# -eq 1 ] + local zone=${1} + + local config + local hids + + for config in $(zone_configs_list ${zone}); do + # Append hids to the list + zone_config_get_hid "${zone}" "${config}" + done +} + +# get the hid from a given config +zone_config_get_hid() { + assert [ $# -eq 2 ] + local zone=${1} + local config=${2} + + local hook + + hook="$(zone_config_get_hook "${zone}" "${config}")" + hook_exec "config" "${hook}" "hid" "${zone}" "${config}" +} + +# Checks if a hid is valid for a given zone +zone_config_hid_is_valid() { + assert [ $# -eq 2] + local zone=${1} + local hid=${2} + + local _hid + for _hid in $(zone_config_list_hids "${zone}"); do + if [[ ${_hid} = ${hid} ]]; then + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + +# This function converts a hid to a id +zone_config_convert_hid_to_id() { + assert [ $# -eq 2 ] + local zone=${1} + local hid=${2} + + local hook + local config + + for config in $(zone_configs_list ${zone}); do + # Get hook from config + hook="$(zone_config_get_hook "${zone}" "${config}")" + if [[ "$(hook_exec "config" "${hook}" "hid" "${zone}" "${config}")" == "${hid}" ]]; then + config_get_id_from_config "${config}" + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + zone_show() { local zone=${1} @@ -1114,6 +1177,23 @@ zone_config_id_is_valid() { [ -f ${zone_path}/configs/*.${id} ]; } +# This function checks if a given hid is valid for a zone +# Return True when yes and false when no +zone_config_hid_is_valid() { + assert [ $# -eq 2 ] + local zone=${1} + local hid=${2} + + local _hid + for _hid in $(zone_config_list_hids ${zone}); do + if [[ ${_hid} == ${hid} ]]; then + return ${EXIT_TRUE} + fi + done + + return ${EXIT_FALSE} +} + zone_config_get_hook_from_id() { # Returns the hook for a given id assert [ $# -eq 2 ] -- 2.6.3

1 7

[PATCH] zone: response with an error if a zone is already up or down
by Jonatan Schlag 25 Jul '17

25 Jul '17

Fixes: #11368 Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index 91ce629..eccca3a 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -369,6 +369,12 @@ zone_up() { return ${EXIT_ERROR} fi + # Check if the zone is already up + if zone_is_active ${zone}; then + log ERROR "Zone ${zone} is already up" + return ${EXIT_ERROR} + fi + # Check if a zone has got the remove tag. if zone_has_destroy_tag ${zone}; then error "Cannot bring up any zone which is to be removed." @@ -405,6 +411,13 @@ zone_down() { return ${EXIT_ERROR} fi + # Check if the zone is already down + if ! zone_is_active ${zone}; then + log ERROR "Zone ${zone} is already down" + return ${EXIT_ERROR} + fi + + local hook="$(zone_get_hook "${zone}")" if [ -z "${hook}" ]; then error "Config file did not provide any hook." -- 2.6.3

2 1

Add hids
by Jonatan Schlag 25 Jul '17

25 Jul '17

The following patches add support for hids in configs. Hids are human readable ids. Please notice that the patches are based on the patchset from the July 24, 2017, 7:10 p.m. beginning with the patch 'zone: add new function zone_config_list_ids' and the following three patches. These four patches needs to be merged first.

2 13

[PATCH 1/4] zone: add new function zone_config_list_ids
by Jonatan Schlag 25 Jul '17

25 Jul '17

Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.zone | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/functions/functions.zone b/src/functions/functions.zone index 91ce629..bba1705 100644 --- a/src/functions/functions.zone +++ b/src/functions/functions.zone @@ -641,6 +641,21 @@ zone_config_show() { zone_config_cmd "show" "$@" } +# Returns a list of all used ids for a zone +zone_config_list_ids() { + assert [ $# -eq 1 ] + + local zone=${1} + local config + local ids + + for config in $(zone_configs_list ${zone}); do + list_append ids "$(config_get_id_from_config ${config})" + done + + echo ${ids} +} + zone_show() { local zone=${1} -- 2.6.3

2 4

[PATCH 1/3] header-zone: refactor hook_edit nad hook_new
by Jonatan Schlag 19 Jul '17

19 Jul '17

We now return error codes and break when something important goes wrong. because of that, we have to split hook_new and hook_edit. When zone_settins-read fails in hook_edit we cannot go but it would every time we would call it in hook_new. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/header-zone | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/src/header-zone b/src/header-zone index 98b0ce7..219b0d6 100644 --- a/src/header-zone +++ b/src/header-zone @@ -34,17 +34,39 @@ hook_new() { assert isset zone shift - zone_settings_read "${zone}" - - hook_parse_cmdline $@ + if ! hook_parse_cmdline $@; then + return ${EXIT_ERROR} + fi - zone_settings_write "${zone}" + if ! zone_settings_write "${zone}"; then + log ERROR "Could not write settings for zone ${zone}" + return ${EXIT_ERROR} + fi exit ${EXIT_OK} } hook_edit() { - hook_new $@ + local zone="${1}" + assert isset zone + shift + + if ! zone_settings_read "${zone}"; then + log ERROR "Could not read settings for zone ${zone}" + return ${EXIT_ERROR} + fi + + if ! hook_parse_cmdline $@; then + return ${EXIT_ERROR} + fi + + if ! zone_settings_write "${zone}"; then + log ERROR "Could not write settings for zone ${zone}" + return ${EXIT_ERROR} + fi + + exit ${EXIT_OK} + } hook_remove() { -- 2.6.3

1 2

[PATCH] list: fix a bug
by Jonatan Schlag 19 Jul '17

19 Jul '17

When the list is called "list" we have a problem because ${list}="list" and ${!list}="list" This creates effects nobody wants and which are also not so easy to understand. To avoid such problems in the future we now throw an assertation when the list is called list. Signed-off-by: Jonatan Schlag <jonatan.schlag(a)ipfire.org> --- src/functions/functions.list | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/functions/functions.list b/src/functions/functions.list index 26ba6c3..ff73b04 100644 --- a/src/functions/functions.list +++ b/src/functions/functions.list @@ -25,6 +25,7 @@ list_append() { local list=${1} assert isset list + assert [ ${list} != "list" ] shift local arg @@ -40,6 +41,7 @@ list_append_one() { shift assert isset list + assert [ ${list} != "list" ] if [ -n "${!list}" ]; then printf -v ${list} -- "${!list} $@" @@ -53,6 +55,7 @@ list_remove() { shift assert isset list + assert [ ${list} != "list" ] local _list k for k in ${!list}; do @@ -127,6 +130,10 @@ list_join() { local list=${1} local delim=${2} + assert isset list + assert isset delim + assert [ ${list} != "list" ] + local ret printf -v ret "${delim}%s" ${!list} -- 2.6.3

1 0

Split the cmd line parsing in the config hooks in seperated functions
by Jonatan Schlag 19 Jul '17

19 Jul '17

Hi the following patches just do what is stated in the subject. If anything else could be improved (I know some code which is touched here and could be improved) i would like to do this when this patchset is merged.

1 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

network July 2017